Snipe Snipe-It vulnerabilities

CVE-2025-15602 [HIGH] CWE-915 Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious

CVE-2026-37709 [CRITICAL] CWE-284 Snipe-IT has insecure permissions in file uploads Snipe-IT has insecure permissions in file uploads Insecure Permissions vulnerability in grokability snipe-it versions through 8.4.0, fixed after 2026-03-10 commit 676a9958, allow a remote attacker to execute arbitrary code via the `app/Http/Controllers/Api/UploadedFilesController.php` component ### Impact Users who can view assets, consumables, etc were able to send a POST request to `/api/v1/{object_type}/{id}

CVE-2026-63493 [HIGH] CWE-288 Snipe-IT: 2FA bypass via the API token flow Snipe-IT: 2FA bypass via the API token flow ### Impact An attacker who knows a victim's password fully bypasses that account's 2FA and obtains a persistent token with full API access as the user (read and write across the user's permissions, including admin if the victim is an admin). The token is an API credential, not a web/UI session (using it on web routes redirects to `/login`), but the REST API covers essentially

CVE-2026-44832 [HIGH] CWE-281 Snipe-IT has Privilege Escalation via API Permissions Assignment Snipe-IT has Privilege Escalation via API Permissions Assignment ### Impact An authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user

CVE-2026-55483 [MEDIUM] CWE-862 Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation ### Impact The `store()` method in both the web and API `UsersController` only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the `users.create` permission to create a new u

CVE-2026-55643 [HIGH] CWE-863 Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode ### Impact Due to inconsistent authorization checks, a company-scoped user can bypass tenant boundaries to read, mutate, and soft-delete users who do not belong to any company (company_id = null). While direct instance authorization (isCurrentUserHasAccess) correctly denies access to these out-of-scope users, multiple API endpoints and bulk action web route

CVE-2022-23064 [HIGH] CWE-74 CVE-2022-23064: In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a spe In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.

CVE-2023-5452 [MEDIUM] CWE-79 Cross-site Scripting in snipe/snipe-it Cross-site Scripting in snipe/snipe-it Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.

CVE-2022-0611 [HIGH] CWE-269 Improper Privilege Management in Snipe-IT Improper Privilege Management in Snipe-IT An unprivileged user of Snipe-IT prior to version 5.3.11 can create maintenance for an asset. Version 5.3.11 contains a patch for this issue.

CVE-2026-54329 [HIGH] CWE-74 Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection ### Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body. The issue oc

CVE-2024-5685 [HIGH] CWE-862 CVE-2024-5685: Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

CVE-2026-55516 [HIGH] CWE-639 Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update ### Impact The API endpoint for updating asset maintenance records allows an authorized user to change the asset_id of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or m

CVE-2026-55466 [MEDIUM] CWE-79 Snipe-IT vulnerable to stored XSS via inline-served attachment Snipe-IT vulnerable to stored XSS via inline-served attachment ### Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finfo MIME is text/xml (an allowed extension)

CVE-2026-55452 [MEDIUM] CWE-1236 Snipe-IT has CSV formula injection in Activity Report export Snipe-IT has CSV formula injection in Activity Report export ### Impact In Snipe-IT v8.6.1 and lower, `Actionlog::logaction()` stores the request User-Agent header in user_agent. That value is later included in the Activity Report CSV export by `ReportsController::postActivityReport()` and written with plain `fputcsv()`. A low-privileged authenticated user can set a formula-like User-Agent, perform a

CVE-2026-55474 [HIGH] CWE-23 Snipe-IT vulnerable to directory traversal in displaySig Snipe-IT vulnerable to directory traversal in displaySig ### Impact The `displaySig` action in `ActionlogController` serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the

CVE-2025-59713 [MEDIUM] CWE-502 Snipe-IT allows unsafe deserialization Snipe-IT allows unsafe deserialization Snipe-IT before 8.1.18 allows unsafe deserialization.

CVE-2026-62368 [HIGH] CWE-79 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers Snipe-IT: Stored XSS via Custom Field name in asset-list column headers ### Impact A user with the "customfields.create" permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 ('title' => $field->name) and injected into the table header by the bundled bootstrap-table plugin. It exec

CVE-2026-50550 [MEDIUM] CWE-862 Snipe-IT has a 2FA reset privilege bypass Snipe-IT has a 2FA reset privilege bypass ### Impact A user who can edit other users could reset a superadmin's 2FA. ### Patches Patched in 8.5.0

CVE-2024-48987 [HIGH] CWE-1393 Snipe-IT remote code execution Snipe-IT remote code execution Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

CVE-2026-55469 [LOW] CWE-22 Snipe-IT has a path traversal vulnerability via CSV import `image` field Snipe-IT has a path traversal vulnerability via CSV import `image` field ### Impact An authenticated user holding the `import` and `assets.update` permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's `image` field via CSV import, then triggering the image deletion feature.